harden(janitor): SHA-pin actions/checkout (org-token-handling action) - #22
harden(janitor): SHA-pin actions/checkout (org-token-handling action)#22asachs01 wants to merge 2 commits into
Conversation
…pp-token)
GAP-2 (warden severity-elevated): the checkout step does token: ${{ steps.app-token.outputs.token }}
to push the backlog, persisting the ORG-WIDE Contents+PR app-token into .git/config. A
floating @v4 tag → a repointed/compromised tag could exfiltrate the crown-jewel token =
fleet-wide compromise. SHA-pin to v4.3.0 (34e114876b0b11c390a56381ad16ebd13914f8d5) per
CI-QW-3. Pure pin, zero behavior change. (create-github-app-token was already pinned.)
warden pin-legitimacy check: 34e114876b0b11c390a56381ad16ebd13914f8d5 is checkout v4.3.1 (current v4 head), NOT v4.3.0 (=08eba0b). SHA is legitimate; the comment mislabeled the version. SHA + comment must AGREE (the comment is how a human audits the intended version). Corrected to v4.3.1 (latest v4 patch, fine to pin).
|
warden pin-legitimacy catch: 34e1148 = v4.3.1 (current v4 head), not v4.3.0 (=08eba0b). SHA is legit; comment was mislabeled → corrected to # v4.3.1. SHA+comment now agree. |
|
Flagging from today's pr-sweep: this PR has a merge conflict with the base branch (mergeable=CONFLICTING) and hasn't been touched in a while. Rebase whenever it's still wanted — not urgent, just surfacing so it doesn't rot silently. |
|
Closing as obsolete — the goal here is already met on This PR changes uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3landed via #24 (the Node 24 action bump). So the org-token-handling checkout step is SHA-pinned today, and merging this would downgrade it v6.0.3 → v4.3.1. The PR is also GAP-2 as described is resolved. Reopen if the pin regresses. Verified against |
1 participant
GAP-2 (warden-elevated): the janitor's checkout step persists the org-wide app-token into .git/config (backlog push). Floating @v4 → repointed-tag = org-token exfil = fleet compromise. SHA-pin to v4.3.0 per CI-QW-3. Pure pin, zero behavior change. Ready for Aaron approve + warden security-glance.